Home » AI Prompts Tutorial

AI Prompts for Cybersecurity

AI can assist cybersecurity professionals with security analysis, threat identification, vulnerability assessment, incident response, log analysis, security documentation, and many other defensive security tasks. Well-designed prompts can help security teams organize information, investigate suspicious activity, and identify areas that require further review.

In this chapter, you will learn 31 practical AI prompts for cybersecurity. These prompts are designed for defensive and authorized security activities such as threat analysis, security monitoring, incident response, vulnerability management, and security awareness.

1. Analyze Security Logs

Security logs can contain a large amount of information that is difficult to review manually. AI can help summarize log entries, identify unusual patterns, and highlight events that may require further investigation.

Example

Analyze the following security logs.

Identify:
- Unusual login activity
- Repeated failed authentication attempts
- Suspicious IP addresses
- Unusual access times
- Other events that require investigation

For each finding, explain why it may be significant.

[Paste authorized security logs here]

2. Identify Suspicious Login Activity

Authentication logs can help security teams identify unusual login behavior. AI can compare login times, locations, IP addresses, and failure patterns to highlight activity that deserves investigation.

Example

Analyze the following authentication events.

Identify unusual login patterns based on:
- Multiple failed login attempts
- Login locations
- Login times
- New devices
- Unusual IP addresses

Separate normal activity from activity that requires investigation.

[Paste authorized authentication logs here]

3. Analyze a Phishing Email

AI can help security teams review suspicious emails for common phishing indicators. The analysis can include sender information, URLs, language, requests for sensitive information, and other warning signs.

Example

Analyze the following email for potential phishing indicators.

Check:
- Sender information
- Suspicious links
- Urgency or pressure
- Requests for credentials or sensitive information
- Unusual language
- Impersonation indicators

Explain each finding and assign a risk level.

[Paste authorized email content here]

4. Analyze a Suspicious URL

Security teams can use AI to organize an initial review of a suspicious URL. The prompt can ask the model to identify visible indicators and recommend safe investigation steps without interacting with the URL.

Example

Analyze the following URL as a cybersecurity analyst.

Identify visible indicators that may require investigation, including:
- Unusual domain structure
- Suspicious subdomains
- URL encoding
- Unusual paths or parameters
- Possible impersonation indicators

Do not access or execute the URL.
Explain what should be investigated further.

URL:
[Paste URL here]

5. Analyze Malware Indicators

Security analysts often need to review indicators associated with potentially malicious files or activity. AI can organize known indicators and explain why specific characteristics may deserve additional investigation.

Example

Analyze the following malware-related indicators.

Review:
- File names
- File hashes
- File paths
- Processes
- Network connections
- Persistence indicators

Classify each indicator as:
Low Risk
Medium Risk
High Risk

Explain the reason for each classification.

[Paste authorized indicators here]

6. Create an Incident Summary

Incident response teams need concise summaries that describe what happened and what actions have been taken. AI can transform technical investigation notes into a structured incident summary for security teams and stakeholders.

Example

Create a cybersecurity incident summary from the following investigation notes.

Include:
- Incident overview
- Detection time
- Affected systems
- Observed indicators
- Actions taken
- Current status
- Recommended next steps

Use clear and professional language.

[Paste authorized investigation notes here]

7. Create an Incident Response Timeline

A timeline helps security teams understand the sequence of events during an incident. AI can organize timestamps and investigation notes into a chronological format.

Example

Create a chronological incident response timeline from the following events.

For each event include:
- Timestamp
- Event
- Affected system
- Evidence
- Action taken

Sort all events from earliest to latest.

[Paste authorized incident data here]

8. Generate Incident Response Questions

During an investigation, security teams need to ask the right questions to understand the scope and impact of an incident. AI can generate investigation questions based on the type of incident being analyzed.

Example

Generate investigation questions for a suspected compromised user account.

Organize the questions into:
- Initial access
- Authentication activity
- Account changes
- Data access
- Network activity
- Containment
- Recovery

Focus on questions that can help determine the scope and impact.

9. Analyze Network Traffic Information

Network traffic data can contain indicators of unusual communication patterns. AI can help organize the available information and identify connections or behaviors that may require further investigation.

Example

Analyze the following authorized network traffic summary.

Look for:
- Unusual destination domains
- Unexpected ports
- Repeated connections
- Unusual traffic volumes
- Communication with unfamiliar systems

Explain which observations require further investigation.

[Paste authorized network data here]

10. Analyze Firewall Logs

Firewall logs can provide useful information about attempted and allowed network connections. AI can summarize the entries and identify unusual patterns for further security review.

Example

Analyze the following firewall logs.

Identify:
- Repeated connection attempts
- Unusual source addresses
- Unexpected destination ports
- Blocked traffic patterns
- Allowed connections that require review

Group related events and explain their significance.

[Paste authorized firewall logs here]

11. Review Security Headers

HTTP security headers can help protect web applications against several common browser-based threats. AI can review a provided set of headers and explain missing or incorrectly configured security controls.

Example

Review the following HTTP security headers.

Check:
- Content-Security-Policy
- Strict-Transport-Security
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy

Identify missing or potentially weak configurations.
Explain the security purpose of each header.

[Paste authorized response headers here]

12. Review Authentication Controls

Authentication is an important part of application security. AI can help review authentication requirements and identify areas that may need stronger controls.

Example

Review the following authentication design for a web application.

Evaluate:
- Password requirements
- Multi-factor authentication
- Session management
- Account lockout
- Password reset
- Login monitoring

Identify potential weaknesses and recommend defensive improvements.

13. Review Authorization Controls

Authentication determines who a user is, while authorization determines what that user is allowed to access. AI can help review authorization requirements and identify possible access-control gaps.

Example

Review the following application authorization design.

The application has:
- Admin users
- Managers
- Standard users

Analyze whether each role has appropriate access.
Identify potential privilege escalation risks and recommend
defensive improvements.

[Describe authorized application permissions here]

14. Review Password Security

Password policies should protect accounts while remaining practical for users. AI can review a proposed password policy and identify areas that may require improvement.

Example

Review the following organizational password policy.

Evaluate:
- Password length
- Password reuse
- Password storage
- Multi-factor authentication
- Account recovery
- Credential monitoring

Identify areas that should be improved and explain why.

15. Analyze Vulnerability Scan Results

Vulnerability scanners can generate large reports containing many findings. AI can help organize those findings, group related vulnerabilities, and prioritize remediation based on severity and business impact.

Example

Analyze the following authorized vulnerability scan results.

For each vulnerability provide:
- Vulnerability
- Severity
- Affected component
- Potential impact
- Recommended remediation
- Suggested priority

Group related findings where appropriate.

[Paste authorized scan results here]

16. Prioritize Vulnerabilities

Organizations may have more vulnerabilities than they can immediately fix. AI can help prioritize remediation by considering severity, exposure, affected assets, and business importance.

Example

Prioritize the following vulnerabilities for remediation.

Consider:
- Severity
- Internet exposure
- Exploitability information provided
- Asset importance
- Potential business impact

Create three categories:
Critical Priority
High Priority
Normal Priority

Explain the reasoning for each priority.

[Paste authorized vulnerability data here]

17. Create a Vulnerability Remediation Plan

A remediation plan turns vulnerability findings into actionable security work. AI can organize vulnerabilities into tasks and suggest a logical remediation sequence.

Example

Create a vulnerability remediation plan from the following findings.

For each finding include:
- Vulnerability
- Affected system
- Recommended fix
- Responsible team
- Priority
- Suggested verification step

Focus on defensive remediation.

[Paste authorized vulnerability findings here]

18. Review Cloud Security Configuration

Cloud environments contain many configuration settings that affect security. AI can help review a provided configuration against common defensive principles and identify areas that require attention.

Example

Review the following cloud security configuration.

Check:
- Public access
- Identity and access management
- Storage permissions
- Logging
- Encryption
- Network access
- Security monitoring

Identify potentially risky configurations and recommend
defensive improvements.

[Paste authorized configuration details here]

19. Review IAM Permissions

Excessive permissions can increase the impact of a compromised account. AI can review an authorized IAM permission set and identify permissions that may be broader than necessary.

Example

Review the following IAM permissions.

Identify:
- Excessive permissions
- Broad administrative access
- Unnecessary services
- Potential privilege escalation concerns
- Opportunities to apply least privilege

Provide a recommended permission structure.

[Paste authorized IAM policy here]

20. Analyze Security Alerts

Security teams often receive many alerts from monitoring and detection systems. AI can help summarize alerts, group related events, and identify which alerts may require analyst attention.

Example

Analyze the following security alerts.

For each alert provide:
- Alert type
- Severity
- Affected asset
- Relevant indicators
- Possible explanation
- Recommended investigation step

Group alerts that appear to be related.

[Paste authorized security alerts here]

21. Create SIEM Investigation Queries

Security analysts often use SIEM platforms to search large amounts of security data. AI can help translate an investigation requirement into a query for the specific SIEM syntax being used.

Example

Create a defensive SIEM query to identify repeated failed
login attempts from the same source within a short period.

SIEM Platform:
[Specify SIEM platform]

Requirements:
- Search authentication logs
- Group events by source address
- Identify repeated failures
- Include a time window
- Explain what each part of the query does

22. Create Detection Rules

Detection rules can help security teams identify suspicious behavior in monitored environments. AI can assist with drafting a detection rule based on known defensive indicators and expected event patterns.

Example

Create a defensive detection rule for repeated failed
authentication attempts.

Include:
- Detection logic
- Required log fields
- Suggested threshold
- Possible false positives
- Recommended investigation steps

Explain how the rule should be tested before deployment.

23. Identify Indicators of Compromise

Indicators of compromise can provide clues about potentially malicious activity. AI can extract and organize indicators from authorized incident data so that analysts can review them more efficiently.

Example

Extract potential indicators of compromise from the following
authorized incident report.

Look for:
- IP addresses
- Domains
- File hashes
- File names
- URLs
- Processes
- User accounts

Return the results in a structured table.

[Paste authorized incident report here]

24. Create a Threat Intelligence Summary

Threat intelligence reports can contain large amounts of technical information. AI can summarize the information into a format that security teams can use for defensive planning and investigation.

Example

Summarize the following threat intelligence report.

Include:
- Threat overview
- Targeted sectors
- Observed indicators
- Techniques mentioned in the report
- Potential impact
- Defensive recommendations

Clearly separate confirmed information from assumptions.

[Paste authorized threat intelligence report here]

25. Map Findings to MITRE ATT&CK

Security teams can use the MITRE ATT&CK framework to organize observed adversary behaviors. AI can help map documented observations to potentially relevant techniques while clearly identifying areas that require analyst validation.

Example

Analyze the following authorized incident observations.

Map each observed behavior to the most relevant MITRE ATT&CK
technique or tactic where appropriate.

For each mapping provide:
- Observed behavior
- Tactic
- Technique
- Reason for mapping
- Confidence level

Do not invent evidence that is not present in the observations.

[Paste authorized observations here]

26. Create a Security Risk Assessment

A security risk assessment can help organizations understand potential threats to systems, applications, and data. AI can organize identified risks and help create a structured assessment for further review by security professionals.

Example

Create a cybersecurity risk assessment for the following application.

Consider:
- Authentication
- Authorization
- Data protection
- Network security
- Logging and monitoring
- Third-party dependencies
- Backup and recovery

For each risk provide:
- Risk description
- Likelihood
- Potential impact
- Risk level
- Recommended mitigation

[Describe authorized application here]

27. Create a Security Awareness Training Scenario

Security awareness training can help employees recognize common security threats. AI can create realistic but safe training scenarios for phishing awareness, password security, social engineering awareness, and secure data handling.

Example

Create a cybersecurity awareness training scenario about phishing.

The scenario should:
- Be suitable for office employees
- Demonstrate common phishing warning signs
- Include a short fictional email
- Ask employees to identify suspicious indicators
- Provide an explanation of the correct response

Do not use real credentials, real organizations, or real malicious links.

28. Create a Security Policy

Organizations often need documented security policies covering access, passwords, devices, data, and incident reporting. AI can create an initial policy structure that can then be reviewed and adapted to organizational requirements.

Example

Create a cybersecurity policy for a small software company.

Include:
- Account security
- Password management
- Multi-factor authentication
- Device security
- Data protection
- Remote access
- Security incident reporting
- Employee responsibilities

Use clear and professional language.

29. Create an Incident Response Playbook

An incident response playbook provides a repeatable process for handling a particular type of security incident. AI can help organize the stages, responsibilities, decision points, and documentation requirements.

Example

Create a defensive incident response playbook for a suspected
compromised user account.

Include:
1. Detection
2. Initial assessment
3. Evidence collection
4. Containment
5. Credential protection
6. Investigation
7. Recovery
8. Post-incident review

For each stage, include actions, responsible roles, and
verification steps.

30. Create a Security Audit Checklist

Security audits require systematic reviews of technical and organizational controls. AI can create a checklist that security teams can customize according to their environment, policies, and compliance requirements.

Example

Create a cybersecurity audit checklist for a web application.

Cover:
- Authentication
- Authorization
- Input validation
- Session management
- Encryption
- Security headers
- Logging
- Monitoring
- Backup
- Dependency management
- Access control

For each item include:
- Check
- Evidence required
- Status
- Notes

31. Create a Security Incident Report

A formal incident report documents what happened, which systems were affected, how the incident was handled, and what improvements are required. AI can transform investigation notes into a structured report while keeping confirmed facts separate from assumptions.

Example

Create a formal cybersecurity incident report from the following
authorized investigation notes.

Include:
- Executive summary
- Incident description
- Detection
- Timeline
- Affected systems
- Indicators
- Root cause, if confirmed
- Impact
- Containment actions
- Recovery actions
- Lessons learned
- Recommended improvements

Clearly distinguish confirmed facts from assumptions.

[Paste authorized investigation notes here]

General AI Prompt Template for Cybersecurity

A reusable cybersecurity prompt template can help security professionals provide the AI model with the information needed for a specific defensive task. The template can be adapted for log analysis, incident response, vulnerability management, threat analysis, security audits, and other authorized security activities.

Example

Role:
Act as a cybersecurity analyst.

Task:
[Describe the security task]

Environment:
[Describe the authorized environment]

Context:
[Provide relevant background information]

Data:
[Paste authorized logs, findings, alerts, or other information]

Requirements:
- [Requirement 1]
- [Requirement 2]
- [Requirement 3]

Expected Output:
[Describe the required output format]

Additional Instructions:
- Separate confirmed findings from assumptions.
- Identify information that requires further verification.
- Focus on defensive recommendations.